As we have long feared, and as has already happened in other countries, COVID-19 vaccination requirements are being used to impose unrelated ID requirements.

There’s a difference between “unvaccinated” and “undocumented” — a difference that’s  gotten lost in some recent regulations and orders imposing “vaccination mandates”.

Case in point: the San Francisco Department of Public Health.

An order from the SFDPH  purports to require people entering indoor businesses or other indoor venues including anywhere food or beverages are served, gyms, and other “large indoor events”  to show “proof” of having been fully vaccinated against COVID-19.

But proof of vaccination is not what the order actually mandates. Its only real mandate is a an ID mandate, and in practice its effects would be felt primarily by undocumented people (including vaccinated but undocumented people) who don’t have or don’t choose to show ID, not by unvaccinated people.

Regardless of whether you’ve been vaccinated or whether you think other people should be vaccinated, the ID mandate hidden in this order, like similar ID mandates lurking in other “vaccination” regulations and directives, is a step backward for civil liberties. It is vulnerable to, and deserving of, Constitutional challenge.

Here’s what the SFDPH order would actually require:

The SFDPH order defines several acceptable forms of “proof” of vaccination including, among others, a paper vaccination card printed in blank by the Centers for Disease Control (CDC) and filled in by hand at a vaccination site, a photocopy of such a card, an image of such a card displayed on a smartphone, a QR code displayed on a smartphone, or “a written self-attestation of vaccination signed… under penalty of perjury.”

None of these, with the possible exception of a declaration under penalty of perjury, provides more than the flimsiest evidence that someone (not necessary the person presenting the card or paper copy or showing the image or QR code) was vaccinated. None of them provides “proof”.

Anyone could write anything on a blank CDC card, photocopy such a card, copy an image or QR code, create a QR code, borrow a smartphone on which an image or QR code is already stored, or edit such an image to fill in the blanks or change the name or other information.

The most secure of these forms of evidence, at least in terms of the risk taken by someone using it to support a false claim to have been vaccinated, would appear to be a self-certification under penalty of perjury. It’s not clear what law would be violated by changing the name in an image of a vaccination card. And whatever might be said — in seriousness or in jest — about the possible penalties for misuse of Photoshop, the penalties for perjury are probably quite a bit more serious than those for altering an image of a vaccination card.

But while the SFDPH order defines a self-certification as “proof” of having been vaccinated, Appendix B to the order defines a variety of venues and events for which a self-certification of having been vaccinated will not be accepted, but other trivially produced forms of evidence of having been vaccinated will be accepted.

There are other inexplicable quirks in which forms of evidence of vaccination are and aren’t acceptable under the SFDPH order.

The most “official” and widely-recognized record of vaccination is the International Certificate of Vaccination or Prophylaxis (“yellow book”), a longstanding global standard adopted by the World Health Organization (WHO) pursuant to international treaties. These can be used to record vaccinations against COVID-19, and in some countries including Germany they are the primary vaccination records being issued to individuals. In the US, WHO-standard blank “yellow books”  are issued by the CDC and distributed to health care providers and the public by the US Government Printing Office.

The SFDPH doesn’t include the CDC “yellow book” in its list of acceptable forms of “proof” of having been vaccinated (although international health regulations require its acceptance), but does include any “similar documentation issued by another foreign governmental jurisdiction.” So a WHO-standard yellow book from any other country is acceptable, but not one from the US CDC. Is this deliberate? If so, why?

But that’s not all, and that’s not the worst feature of the SFDPH order.

For the venues and events defined in Appendix B to the order, “Covered Businesses are required to cross-check proof of Full Vaccination for each patron against a photo identification.”

What does this mean? Members of the public and businesses charged with enforcing the order are left to guess. Despite detailed (albeit, as discussed above, arbitrary and unexplained) definitions and specifications of acceptable evidence of vaccination, the SFDPH order contains no definition at all of “photo identification”.

Responsibility for enforcing this order is assigned to businesses (i.e. to their frontline staff) and operators of venues and events, none of whom have any particular expertise or qualifications to assess claims or evidence of vaccination or identity. There’s no reason to expect such a system to be any more effective at controlling who is actually allowed to enter venues subject to the SFDPH order than the existing and widely flouted rules purporting to require evidence of age to purchase alcohol, tobacco, or other items.

Whatever is meant by the mandate to “cross-check proof of Full Vaccination… against a photo identification,” it is likely to imply a requirement to remove face masks, which (as at TSA checkpopints and other places where masks must be removed for ID checks) poses a clear health risk.

As is typical of government orders requiring individuals to show ID to private businesses, the SFDPH order places no restrictions on the ability of those businesses to scan ID credentials (which they are likely to start doing just to be able to show that they have complied with the order to make all workers and patrons show ID) and to retain, use, or monetize the databases of personal ID data they have thus compiled. There are no requirements for securing this sensitive personal data or disclosing how it has been used or with whom it has been shared.

Do you want every restaurant, bar, club, gym, or theater you have attended to have a copy  of your passport number in an insecure  jury-rigged database? Or to be able to make a little extra money off each customer by selling this information to a commercial data aggregator — without telling you they have done so?

The SFDPH order also applies to events open to the public and held at indoor public forums operated by government agenccies, to which entry is a right. If someone reserves a room at the library or rents the Civic Auditorium for a political meeting, should the government, as operator of the venue, be allowed to require that attendees identify themselves, and keep a record of who attended? We think not.

While the SFDPH order allows, or at least originally allowed, self-certification of vaccination in some circumstances, it doesn’t explicitly allow self-certification of identity. In the absence of any definition or qualification of “a photo identification”, it’s at least arguable that the requirements of the SFDPH order could be satisfied by showing a self-certified photo ID, such as a photo with your name or signature written on the back. We’d be interested in hearing from anyone who has tried to gain entry to a covered venue or event with such self-certified photo ID. If you are turned away, what recourse do you have, if any?

It’s particularly irrational and unfair that the SFDPH is requiring evidence of vaccination to be “cross-check[ed] … against … photo identification”, when no identification at all has been, or is being required by the SFDPH to receive a COVID-19 vaccination.

As the City and County of SF says, “You can get a free COVID-19 vaccination regardless of your immigration status” and without ID. That’s as it should be. Undocumented people are at just as much risk of infection themselves, and pose just as much of a risk of infection to others, as people who have and choose to show ID.

The effect of the ID mandate is that undocumented people who have been vaccinated against COVID-19 by the SFDPH at its vaccination sites are prohibited by the SFDPH, purportedly on the basis of their vaccination status, from patronizing or working in restaurants or other covered venues. There is no rational relationship between the ID provisions of the order and any health purpose.

Vaccinated but undocumented people are barred from working in, patronizing, or attending events at restaurants and many other indoor venues in SF. Unvaccinated people with acceptable ID can get into those same venues by copying and/or making trivial changes to a vaccination card or image.

The burden of the SFDPH order will fall primarily on vaccinated people who are undocumented or who don’t choose to show ID, not on unvaccinated people.

A variety of people don’t have ID — especially in a dense city like San Francisco with many transportation options that don’t  require a drivers license — or don’t choose to show ID. Many of them are vaccinated against COVID-19.

Having been vaccinated isn’t proof of not being infected or not being infectious. A significant percentage of current COVID-19 cases in San Francisco, as throughout the U.S.,  are among people who have been vaccinated. But neither is having or showing ID proof of not being infected or not being infectious. Government-issued ID is not a magic talisman against COVID-19 and does nothing to enhance the effectiveness of any vaccine. There is no reason to conflate ID with vaccination, and good reasons to keep them separate.

Because the SFDPH order applies to workers as well as patrons in any of the venues to which it applies, it constitutes (or purports to constitute) an additional bar prohibiting undocumented people — even if they are vaccinated — from working in restaurants or other covered venues. Was this really what was intended? Or it is just another example of the inevitability of unintended  collateral damage whenever ID requirements are imposed?

Supporters of universal ID requirements have long been quick to seize any opportunity to embed ID requirements in short-term rules that can then be made permanent. COVID-19 vaccination requirements, no matter how well intended, are being used as the latest such pretext. Officials genuinely concerned with public health should resist any attempt to hide ID requirements or ID-linked surveillance in vaccination rules.

This is just one case study of the “health” orders in San Francisco. How widespread are vaccination rules that are Trojan horses for ID rules? What do they say? Have they been challenged?

We’re interested in hearing about other “vaccination mandates” hiding ID requirements (please share links in the comments) and in hearing from any attorneys interested in working on challenges to this new flavor of back-door ID mandate.